KYC is procedural. Identity infrastructure is structural.
Why modern identity risk lives in payment rails, identity graphs and device telemetry, not in the onboarding check.
- KYC does not create identity. It attaches a person to identity infrastructure that already exists.
- Persistence comes from the layers underneath: payment networks, biometric systems, identity graphs, and the device signals that reconnect you after a reset.
- Oversight that stops at KYC vendors watches the interface, not the infrastructure.
KYC deserves scrutiny. It is not where identity persists.
Most conversations about identity risk start with KYC (know your customer) and AML vendors, and that is understandable. These systems onboard customers, collect identity documents, screen sanctions lists and satisfy regulators. They are visible, procedural and auditable.
Regulators are right to look hard at them. Modern onboarding collects government IDs, biometric scans, proof of address, financial documents, and device and behavioral metadata. That raises real concerns: overcollection, retention, vendor sprawl, and secondary use of identity documents. Data minimization matters.
But if every KYC provider adopted perfect minimization tomorrow, the broader risk would remain. KYC is not where identity becomes persistent. It is where an institution attaches a person to identity infrastructure that already exists.
Procedural systems act on identity. Structural systems shape how it exists.
Execute policy, inside one institution
- Verify documents
- Screen sanctions lists
- Trigger enhanced due diligence
- Freeze or escalate accounts
Operate across institutions and sectors
- Anchor identity
- Bind it across contexts
- Amplify its visibility
- Persist its signals from one sector to the next
Structure shapes procedure. Procedure legitimizes structure.
Five tiers. The higher ones are visible. The lower ones hold the power.
Investigative tools
Make identity easier to discover. They search and watch; they do not operate the rails.
Institutional gatekeepers
Execute decisions inside one organization: approve or deny onboarding, trigger reviews, escalate monitoring. They consume identity signals; they do not create them.
Identity utilities
Let software plug identity signals in directly. Once identity is programmable, it is portable, and once it is portable, it persists.
Identity amplifiers
Turn fragmented signals into a portable profile that works across institutions.
Foundational rails
Anchor identity at infrastructure scale and across sectors. When they add a signal, it cascades. Opt-out is limited or nonexistent.
If oversight looks only at the upper tiers, the foundation goes unexamined.
Five signal types carry most of it.
Across the vendors we have mapped, the market looks complicated, but most identity systems cluster around a small number of signal types. Different vendors hold different pieces. Persistence appears when the pieces are combined.
- 01Device telemetry
- 02Financial transactions
- 03Government identifiers
- 04Behavioral analytics
- 05Biometrics
Three rails do the most to make identity stick.
Financial identity rails
Payment networks connect banks, merchants, fintech platforms, subscriptions and marketplaces. Financial identity is hard to rotate, and retention rules keep it on file.
Tie an identity to a payment rail and the anchor travels across the economy.
Cross-domain identity graphs
Aggregators stitch together addresses, phone numbers, emails, financial records, telecom metadata and behavior into a probabilistic graph that many sectors draw on.
Deleting one dataset rarely removes the structure underneath.
Device identity
Device intelligence reads browser fingerprints, hardware traits, network signals and behavior. The identity is inferred, not created by the user.
Delete the account, clear the cookies, and the device often reconnects you.
Where some familiar names sit.
To show the difference between structural and procedural systems, here is a small cross-section of the dataset. Notice where KYC vendors fall: above the infrastructure. Their job is not to build identity rails. It is to connect people to them.
| Tier | Example | Structural role |
|---|---|---|
| Tier 1 | Visa | Global payment network: a transaction identity rail |
| Tier 1 | Mastercard | Global payment network: a transaction identity rail |
| Tier 1 | IDEMIA | Biometric enrollment for national identity programs |
| Tier 1 | NEC | Government biometric identity systems |
| Tier 1 | Palantir | Data integration platform used to link records across domains |
| Tier 2 | Experian | Credit and identity data used across sectors |
| Tier 2 | Chainalysis | Blockchain analytics: a domain-specific identity graph |
| Tier 3 | Okta | Enterprise identity and access infrastructure |
| Tier 4 | NICE Actimize | Financial crime and compliance decision engine |
Seven patterns that explain why identity is so hard to unwind.
Infrastructure concentrates
Services that look independent often sit on the same payment networks, credit data, biometric vendors and identity graphs. When one of those layers adds signals, the change cascades to everything built on it.
Identity risk concentrates where identity infrastructure concentrates.
Identity crosses sectors
Financial activity feeds fraud systems. Telecom metadata shows up in verification platforms. Behavior collected in consumer apps flows into advertising graphs and security tools.
Identity data rarely stays where it was collected.
Fusion creates persistence
No vendor holds every signal. Persistence appears where device, financial, government, behavioral and biometric signals meet inside a graph or a platform.
Identity becomes durable when signals converge.
The device is a silent rail
Fingerprints, hardware attributes, network traits and behavior let platforms reconnect a person across accounts and sessions, even after a reset. The user never chose to create that identity.
Your device often knows who you are before the platform does.
Procedure depends on structure
Compliance, fraud and onboarding systems look like the center of decision-making, but they run on upstream signals from graphs, device intelligence, credit data and payment networks.
Procedural systems act on identity. Infrastructure defines it.
Identity is becoming programmable
Access platforms, resolution APIs and device intelligence let developers query identity, score risk and link records through an API call.
Programmable identity becomes portable identity.
Oversight watches the wrong layer
Regulation focuses on KYC vendors and onboarding because they are visible and institution-specific. The layers that make identity persist operate across institutions, and are examined least.
Regulation often watches the interface, not the infrastructure.
Risk becomes systemic, not procedural.
When identity is linked across domains, bound to economic rails, anchored in biometrics and enriched by cross-sector graphs, the risk stops being a property of any one system. Even where deletion is technically possible, the signals have already propagated. Persistence becomes distributed.
An account freeze can be reversed. A structural identity graph cannot.Jeff Jockisch, ObscureIQ
This note shows a small subset of our identity infrastructure map, which classifies vendors by tier and structural role. Regulators, researchers and privacy professionals can request access at data@obscureiq.com. We keep refining the model as the infrastructure changes.
- AN-001 · this noteKYC is procedural. Identity infrastructure is structural.
- AN-002Myth: deleting your data erases your identity.
- AN-003Deep identity vs. privacy settings.
- AN-004The internet knows everything about you.
Look below the onboarding check.
For privacy and regulatory teams
- Map your identity vendors to these five tiers before you assess any one of them.
- Ask KYC and fraud vendors which upstream sources they query: graphs, device intelligence, bureau data.
- Put device intelligence and identity resolution APIs in scope for privacy reviews. They are rarely there.
- Judge deletion at the graph level, not by the one dataset a request reached.
For individuals at risk
- Reduce what you can at the broker and aggregator tier; it still shrinks what an adversary can buy.
- Expect device signals to reconnect you after a reset. Separate devices do more than cleared cookies.
- Reset your phone's advertising ID and use it in deletion requests.
- Treat payment and biometric enrollment as long-lived decisions. Those anchors are the hardest to move.
The pieces behind this note.
- ObscureIQ identity infrastructure dataset: vendors classified by tier and structural role. This note shows a subset; access on request at data@obscureiq.com.
- The five-tier model and signal categories are ObscureIQ analysis. Company roles in Fig. 2 are illustrative classifications, not findings about any company's conduct.
As of 3 November 2026.
Updated 3 November 2026: moved to the Analyst Note format as AN-001. The stack, the pyramid and the cross-section table now use the same five tiers; company roles are described neutrally; duplicated lines removed. First published 4 March 2026.
Identity analysis, as it is written.
The Tactical Privacy Wire on Substack carries our public analysis. If identity infrastructure is already being used against you, the first call is confidential.